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IN THE CLAIMS 

1 . (Currently Amended) A computer-based method for use in accordance with an event 
management system, the method comprising the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes represent events 
and links connect correlated nodes; and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system; 

wherein, when one or more previously generated event relationship networks are available, 
the step of automatically generating one or more event relationship networks comprises: 

obtaining one or more previously generated event relationship networks: 

validating the one or more previously generated event relationship networks by removing anv 
nodes or links included therein that are incorrect for a particular application context: 

completing the one or more previously generated event relationship networks bv adding any 
nodes or links thereto that are missing for the particular application context: 

outputting the one or more validated and completed event relationship networks as the one 
or more event relationship networks used to construct the one or more correlation rules; 

further wherein the validating step, for a particular event relationship network, comprises: 

splitting the event relationship network into correlation paths: 

for every correlation path, removing a node that has the least number of correlated nodes 
associated therewith until every node is fuUv correlated with every other node; and 

merging correlation paths into one or more event relationship networks such that every path 
in a resulting event relationship network has everv node fully correlated with every other node in the 
path . 

2. (Original) The method of claim 1, further comprising the step of subjecting the one or 
more generated event relationship networks to human review prior to utilizing the one or more 
generated event relationship networks to construct the one or more correlation rules. 
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3. (Canceled). 
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4. (Currently amended) The method of claim 3 1, wherein the validating and completing 
steps utilize a statistical correlation analysis. 

5. (Original) The method of claim 4, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in accordance 
with one or more statistical measurements. 

6. (Currently amended) The method of claim 3- 1, wherein the validating step comprises, for 
a particular event relationship network, determining that links in the event relationship network have 
a confidence level not less than a given threshold. 

7. (Canceled). 

8. (Original) The method of claim 1 , wherein, when one or more previously generated event 
relationship networks are not available, the step of automatically generating one or more event 
relationship networks comprises: 

mining patterns from the event data; 

utilizing the mined patterns to construct the one or more event relationship networks; 
outputting the one or more event relationship networks constructed from the mined patterns 
as the one or more event relationship networks used to construct the one or more correlation rules. 

9. (Original) The method of claim 8, wherein the constructing step utilizes a statistical 
correlation analysis to mine patterns. 
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10. (Original) The method of claim 8, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in accordance 
with one or more statistical measurements. 

1 1 . (Original) The method of claim 1 , wherein the event data is obtained from an event log 
representing historical events associated with a particular system being managed by the event 
management system. 

1 2. (Original) The method of claim 1 , wherein the one or more event relationship networks 
comprise annotations relating to statistical correlation between nodes. 

1 3 . (Original) The method of claim 1 , wherein the event data is preprocessed prior to use in 
generating the one or more event relationship networks by removing at least a portion of any 
redundant events. 

14. (Currently Amended) Apparatus for use in accordance with an event management 
system, the apparatus comprising: 

at least one processor operative to: (i) automatically generate one or more event relationship 
networks from event data, wherein an event relationship network comprises a graphical 
representation wherein nodes represent events and links connect correlated nodes; and (ii) utilize the 
one or more generated event relationship networks to construct one or more correlation rules for use 
by a correlation engine in the event management system; and 

memory, coupled to the at least one processor, which stores at least one of the event data and 
the one or more event relationship networks; 

wherein, when one or more previously generated event relationship networks are available, 
the operation of automatically generating one or more event relationship networks comprises: 

obtaining one or more previously generated event relationship networks: 
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validating the one or more previously generated event relationship networks by removing any 
nodes or links included therein that are incorrect for a particular application context: 

completing the one or more previously generated event relationship netvyorks by adding any 
nodes or links thereto that are missing for the particular application context:and 

outputting the one or more validated and completed event relationship networks as the one 
or more event relationship networks used to construct the one or more correlation rules: 

wherein the validating operation, for a particular event relationship network, comprises: 

splitting the event relationship network into correlation paths: 

for every correlation path, removing a node that has the least number of correlated nodes 
associated therewith until every node is fully correlated with every other node: and 

merging correlation paths into one or more event relationship networks such that every path 
in a resulting event relationship network has every node fully correlated with every other node in the 
path . 

15. (Original) The apparatus of claim 14, wherein the at least one processor is further 
operative to permit the operation of subj ecting the one or more generated event relationship networks 
to human review prior to utilizing the one or more generated event relationship networks to construct 
the one or more correlation rules. 

16. (Canceled) 

17. (Currently amended) The apparatus of claim i6 14, wherein the validating and 
completing operations utilize a statistical correlation analysis. 

1 8 . (Original) The apparatus of claim 1 7, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in accordance 
with one or more statistical measurements. 
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19. (Currently amended) The apparatus of claim 14, wherein the validating operation 
comprises, for a particular event relationship network, determining that links in the event relationship 
network have a confidence level not less than a given threshold. 

20. (Canceled) 

21 . (Original) The apparatus of claim 14, wherein, when one or more previously generated 
event relationship networks are not available, the step of automatically generating one or more event 
relationship networks comprises: 

mining patterns from the event data; 

utilizing the mined patterns to construct the one or more event relationship networks; 
outputting the one or more event relationship networks constructed from the mined patterns 
as the one or more event relationship networks used to construct the one or more correlation rules. 

22. (Original) The apparatus of claim 21, wherein the constructing operation utilizes a 
statistical correlation analysis to mine patterns. 

23 . (Original) The apparatus of claim 2 1 , wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in accordance 
with one or more statistical measurements. 

24. (Original) The apparatus of claim 14, wherein the event data is obtained from an event 
log representing historical events associated with a particular system being managed by the event 
management system. 

25. (Original) The apparatus of claim 14, wherein the one or more event relationship 
networks comprise aimotations relating to statistical correlation between nodes. 
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26. (Original) The apparatus of claim 1 4, wherein the event data is preprocessed prior to use 
in generating the one or more event relationship networks by removing at least a portion of any 
redundant events. 

27. (Currently Amended) An article of manufacture for use in accordance with an event 
management system, the article comprising a machine readable storage medium containing one or 
more programs which when executed implement the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes represent events 
and links connect correlated nodes; and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system; 

wherein, when one or more previously generated event relationship networks are available, 
the step of automatically generating one or more event relationship networks comprises: 

obtaining one or more previously generated event relationship networks: 

validating the one or more previously generated event relationship networks by removing any 
nodes or links included therein that are incorrect for a particular application context; 

completing the one or more previously generated event relationship networks by adding any 
nodes or links thereto that are missing for the particular application context; 

outputting the one or more validated and completed event relationship networks as the one 
or more event relationship networks used to construct the one or more correlation rules; 

further wherein the validating step, for a particular event relationship network, comprises: 

splitting the event relationship network into correlation paths; 

for every correlation path, removing a node that has the least number of correlated nodes 
associated therewith until every node is fully correlated with every other node; and 

merging correlation paths into one or more event relationship networks such that every path 
in a resulting event relationship network has every node fully correlated with every other node in the 
path . 
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28. (Currently amended) The method of claim 1, A computer-based method for use in 
accordance with an event management system, the method comprising the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes represent events 
and links connect correlated nodes: and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system: 

further wherein automated generation of at least one of the one or more event relationship 
networks comprises use of an automated pairwise statistical correlation procedure which is 
configured to compute a first correlation metric and a second correlation metric, the second 
correlation metric being representative of a correlation between events that is stronger than a 
correlation between events represented by the first correlation metric. 

29. (Currently amended) The method of claim 1, A computer-based method for use in 
accordance with an event management system, the method comprising the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes represent events 
and links connect correlated nodes: and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system: 

further wherein automated generation of at least one of the one or more event relationship 
networks comprises specifying an event data window within which event data is considered. 
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